Описание
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Ссылки
- Release Notes
- Release Notes
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.123.61 (исключая)Версия от 2.0.0 (включая) до 2.27.4 (исключая)
Одно из
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
cpe:2.3:a:n8n:n8n:2.28.0:*:*:*:*:node.js:*:*
EPSS
Процентиль: 49%
0.0066
Низкий
7.1 High
CVSS3
Дефекты
CWE-1321
Связанные уязвимости
github
около 1 месяца назад
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
EPSS
Процентиль: 49%
0.0066
Низкий
7.1 High
CVSS3
Дефекты
CWE-1321